https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 09:33:11 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-09234 bdu:2026-09234 https://cve.radiocsirt.org/vuln/bdu:2026-09234 https://cve.radiocsirt.org/vuln/euvd-2026-333756 EUVD-2026-333756 https://cve.radiocsirt.org/vuln/euvd-2026-333756 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22874 <p>Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.</p> <p>Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22874 https://cve.radiocsirt.org/vuln/ghsa-2r5c-gw76-rh3w <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea&#39;s default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go&#39;s standard library [`net.IP.IsPrivate()`](https://pkg.go.dev/net#IP.IsPrivate), which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal networks, and IPv6 transition mechanisms are not blocked, allowing authenticated users to send HTTP requests to those destinations and read the responses via the webhook history UI.</p> <p>## Details</p> <p>The vulnerability lives in [`HostMatchList.checkIP`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114), specifically [line 103](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L103):</p> <p>```go case MatchBuiltinExternal: if ip.IsGlobalUnicast() &amp;&amp; !ip.IsPrivate() { return true } ```</p> <p>`net.IP.IsPrivate()` recognises only: - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (RFC 1918) - `fc00::/7` (RFC 4193 IPv6 ULA)</p> <p>It does **not** recognise:</p> <p>| Range | Description | |---|---| | `100.64.0.0/10` | RFC 6598 Carrier-Grade NAT | | `168.63.129.16/32` | Azure WireServer metadata endpoint | | `172.32.0.0/11` | Non-RFC1918 portion of `172.0.0.0/8` (real-world internal use) | | `64:f…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea&#39;s default SSRF allow-list ([`MatchBuiltinExternal`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L26-L27), used by both webhook delivery and repository migrations) relies on Go&#39;s standard library [`net.IP.IsPrivate()`](https://pkg.go.dev/net#IP.IsPrivate), which only covers RFC 1918 and RFC 4193. As a result, several IP ranges commonly used for cloud metadata services, internal networks, and IPv6 transition mechanisms are not blocked, allowing authenticated users to send HTTP requests to those destinations and read the responses via the webhook history UI.</p> <p>## Details</p> <p>The vulnerability lives in [`HostMatchList.checkIP`](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L96-L114), specifically [line 103](https://github.com/go-gitea/gitea/blob/4c37f4dacbac022f7beca75272439331f0368830/modules/hostmatcher/hostmatcher.go#L103):</p> <p>```go case MatchBuiltinExternal: if ip.IsGlobalUnicast() &amp;&amp; !ip.IsPrivate() { return true } ```</p> <p>`net.IP.IsPrivate()` recognises only: - `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16` (RFC 1918) - `fc00::/7` (RFC 4193 IPv6 ULA)</p> <p>It does **not** recognise:</p> <p>| Range | Description | |---|---| | `100.64.0.0/10` | RFC 6598 Carrier-Grade NAT | | `168.63.129.16/32` | Azure WireServer metadata endpoint | | `172.32.0.0/11` | Non-RFC1918 portion of `172.0.0.0/8` (real-world internal use) | | `64:f…</p> https://cve.radiocsirt.org/vuln/ghsa-2r5c-gw76-rh3w https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2027